Presentation of threat history associated with network activity

• US 9,584,536 B2
• Filed: 12/12/2014
• Issued: 02/28/2017
• Est. Priority Date: 12/12/2014
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Nantel, Mathieu
• Primary Examiner(s): CHANG, KENNETH W
• Application Number:
  US14/568,771
• Publication Number:
  US 20160173446A1
• Time in Patent Office: 809 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 2463/121 Timestamp cryptographic mechanisms or cryptographic arrangements involving time stamps H04L9/3297
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Methods and systems for extracting, processing, displaying, and analyzing events that are associated with one or more threats are provided. According to one embodiment, threat information, including information from one or more of firewall logs and historical threat logs, is maintained in a database. Information regarding threat filtering parameters, including one or more of types of threats to be extracted from the database, parameters of the threats, network-level details of the threats, a time interval of detection of the threats and source-destination details of the threats, is received. Information regarding threats matching the threat filtering parameters are extracted from the database and is presented in a form of an interactive historical graph. Responsive to receiving from a user an indication regarding a selected subset of time in which to zoom into for further details, a list of threats within the selected subset is presented in tabular form.

Claims

1. A method comprising:

maintaining, by a computing device, threat information in a database comprising one or more of firewall logs and historical threat logs;

receiving information regarding a plurality of threat filtering parameters, by the computing device, wherein the information includes one or more of types of threats to be extracted from the database, parameters of the threats, network-level details of the threats, a time interval of detection of the threats and source-destination details of the threats;

extracting, by the computing device, information regarding a plurality of threats from the database based on the plurality of threat filtering parameters; and

presenting, by the computing device, the extracted information in a form of a historical graph illustrating a number of threats by type during a particular period of time; and

receiving from a user, by the computing device, an indication regarding a selected subset of the particular period of time in which to zoom into for further details; and

responsive to the indication regarding the selected subset, presenting, by the computing device, the further details in a form of a list of threats of the plurality of threats corresponding to the selected subset, wherein the list of threats is presented in tabular form, grouped and counted by type of threat and ordered by group in accordance with associated risk levels of the threats in the list of threats.

2. The method of claim 1, wherein the database is updated in real-time.

3. The method of claim 1, wherein the firewall logs, for one or more network traffic flows, store information regarding one or more of parameters of network traffic flows, levels of risk, packet information, source-destination information, host names, infected websites, top destinations for potential threats, top sources of potential threats, origin points of potential threats, event identifiers, types of analysis, bandwidth usage, source Internet Protocol (IP) addresses, destination IP addresses, importance, application details, port information, timestamps, time frames, user details, source device details, destination device details, levels of trust, source operating system details, virus scan levels and schedules.

4. The method of claim 1, wherein the historical threat logs comprise information regarding each of a plurality of observed threats including one or more of a severity, a type and source-destination attributes.

5. The method of claim 1, wherein the historical graph comprises one or more of a stacked area graph, a stacked bar chart, a stacked column chart, a line chart, a point chart, a pie chart, a histogram, a line chart, a tree chart, a organizational chart, a timeline chart, a flowchart, a cartogram, a pedigree chart, a waterfall chart, a polar area chart, and a bubble chart.

6. The method of claim 1, further comprising receiving from the user presentation parameters for customizing the historical graph in accordance with viewable parameters of the plurality of threats, wherein the customization comprises viewing details of threats, viewing relationships between threats, zooming options for minutely assessing details of threats, drag-select options for positioning threats.

7. The method of claim 1, wherein the step of presenting, by the computing device, the extracted information in a form of a historical graph comprises presenting one or more of trends, indicators, and suggestions based on the plurality of threats, wherein the trends indicate one or more of a manner and mode in which the plurality of threats have taken place, and wherein suggestions indicate comments on potential future threats.

8. The method of claim 1, wherein the historical graph is updated in real-time by continuously extracting information from the database based on the plurality of threat filtering parameters.

9. The method of claim 1, wherein the historical graph is updated at pre-defined intervals by periodically extracting information from the database based on the plurality of threat filtering parameters.

10. A non-transitory computer-readable storage medium embodying a set of instructions, which when executed by one or more processors of a network security device, causes the one or more processors to perform a method comprising:

maintaining threat information in a database comprising one or more of firewall logs and historical threat logs;

receiving information regarding a plurality of threat filtering parameters, wherein the information includes one or more of types of threats to be extracted from the database, parameters of the threats, network-level details of the threats, a time interval of detection of the threats and source-destination details of the threats;

extracting information regarding a plurality of threats from the database based on the plurality of threat filtering parameters; and

presenting the extracted information in a form of a historical graph illustrating a number of threats by type during a particular period of time; and

receiving from a user an indication regarding a selected subset of the particular period of time in which to zoom into for further details; and

responsive to the indication regarding the selected subset, presenting the further details in a form of a list of threats of the plurality of threats corresponding to the selected subset, wherein the list of threats is presented in tabular form, grouped and counted by type of threat and ordered by group in accordance with associated risk levels of the threats in the list of threats.

11. The non-transitory computer-readable storage medium of claim 10, wherein the database is updated in real-time.

12. The non-transitory computer-readable storage medium of claim 10, wherein the firewall logs, for one or more network traffic flows, store information regarding one or more of parameters of network traffic flows, levels of risk, packet information, source-destination information, host names, infected websites, top destinations for potential threats, top sources of potential threats, origin points of potential threats, event identifiers, types of analysis, bandwidth usage, source Internet Protocol (IP) addresses, destination IP addresses, importance, application details, port information, timestamps, time frames, user details, source device details, destination device details, levels of trust, source operating system details, virus scan levels and schedules.

13. The non-transitory computer-readable storage medium of claim 10, wherein the historical threat logs comprise information regarding each of a plurality of observed threats including one or more of a severity, a type and source-destination attributes.

14. The non-transitory computer-readable storage medium of claim 10, wherein the historical graph comprises one or more of a stacked area graph, a stacked bar chart, a stacked column chart, a line chart, a point chart, a pie chart, a histogram, a line chart, a tree chart, a organizational chart, a timeline chart, a flowchart, a cartogram, a pedigree chart, a waterfall chart, a polar area chart, and a bubble chart.

15. The non-transitory computer-readable storage medium of claim 10, wherein the method further comprises receiving from the user presentation parameters for customizing the historical graph in accordance with viewable parameters of the plurality of threats, wherein the customization comprises viewing details of threats, viewing relationships between threats, zooming options for minutely assessing details of threats, drag-select options for positioning threats.

16. The non-transitory computer-readable storage medium of claim 10, wherein the step of presenting the extracted information in a form of a historical graph comprises presenting one or more of trends, indicators, and suggestions based on the plurality of threats, wherein the trends indicate one or more of a manner and mode in which the plurality of threats have taken place, and wherein suggestions indicate comments on potential future threats.

17. The non-transitory computer-readable storage medium of claim 10, wherein the historical graph is updated in real-time by continuously extracting information from the database based on the plurality of threat filtering parameters.

18. The non-transitory computer-readable storage medium of claim 10, wherein the historical graph is updated at pre-defined intervals by periodically extracting information from the database based on the plurality of threat filtering parameters.